Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

x/vulndb: potential Go vuln in github.com/cloudflare/cfrpki: CVE-2021-3908 #249

Closed
GoVulnBot opened this issue Jan 7, 2022 · 3 comments
Closed

x/vulndb: potential Go vuln in github.com/cloudflare/cfrpki: CVE-2021-3908 #249

GoVulnBot opened this issue Jan 7, 2022 · 3 comments
Assignees
@neild
Labels
cve-year-2021 excluded: NOT_IMPORTABLE This vulnerability only exists in a binary and is not importable.

Comments

@GoVulnBot
Copy link

In CVE-2021-3908, the reference URL github.com/cloudflare/cfrpki (and possibly others) refers to something in Go.

module: github.com/cloudflare/cfrpki
package: octorpki
description: |
  OctoRPKI does not limit the depth of a certificate chain, allowing for a CA to create children in an ad-hoc fashion, thereby making tree traversal never end.
cves:
- CVE-2021-3908
links:
  context:
  - https://github.com/cloudflare/cfrpki/security/advisories/GHSA-g5gj-9ggf-9vmq

See doc/triage.md for instructions on how to triage this report.
@neild neild self-assigned this Jul 1, 2022
@neild
Copy link
Contributor

neild commented Jul 1, 2022

Vulnerability in tool, not importable package.

Fix CL (affecting only package main):
cloudflare/cfrpki@cb2ab37

@neild neild closed this as completed Jul 1, 2022
@neild neild added the NotGoVuln label Jul 1, 2022
@neild neild added excluded: NOT_IMPORTABLE This vulnerability only exists in a binary and is not importable. and removed NotGoVuln labels Aug 11, 2022
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/592766 mentions this issue: data/reports: unexclude 50 reports

@gopherbot
Copy link
Contributor

Change https://go.dev/cl/607215 mentions this issue: data/reports: unexclude 20 reports (13)

gopherbot pushed a commit that referenced this issue Aug 21, 2024
@tatianab @gopherbot
data/reports: unexclude 20 reports (13)
774eacc 
  - data/reports/GO-2022-0231.yaml
  - data/reports/GO-2022-0249.yaml
  - data/reports/GO-2022-0250.yaml
  - data/reports/GO-2022-0260.yaml
  - data/reports/GO-2022-0261.yaml
  - data/reports/GO-2022-0270.yaml
  - data/reports/GO-2022-0278.yaml
  - data/reports/GO-2022-0281.yaml
  - data/reports/GO-2022-0291.yaml
  - data/reports/GO-2022-0295.yaml
  - data/reports/GO-2022-0298.yaml
  - data/reports/GO-2022-0302.yaml
  - data/reports/GO-2022-0303.yaml
  - data/reports/GO-2022-0304.yaml
  - data/reports/GO-2022-0305.yaml
  - data/reports/GO-2022-0306.yaml
  - data/reports/GO-2022-0307.yaml
  - data/reports/GO-2022-0308.yaml
  - data/reports/GO-2022-0309.yaml
  - data/reports/GO-2022-0310.yaml

Updates #231
Updates #249
Updates #250
Updates #260
Updates #261
Updates #270
Updates #278
Updates #281
Updates #291
Updates #295
Updates #298
Updates #302
Updates #303
Updates #304
Updates #305
Updates #306
Updates #307
Updates #308
Updates #309
Updates #310

Change-Id: Idffc4951124598d58d8ebf3b1c44fc141f192639
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/607215
Reviewed-by: Damien Neil <dneil@google.com>
Auto-Submit: Tatiana Bradley <tatianabradley@google.com>
Commit-Queue: Tatiana Bradley <tatianabradley@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
# for free to join this conversation on GitHub. Already have an account? # to comment
Assignees

@neild neild

Labels
cve-year-2021 excluded: NOT_IMPORTABLE This vulnerability only exists in a binary and is not importable.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
5 participants
@neild @rolandshoemaker @julieqiu @gopherbot @GoVulnBot